Cybersecurity glossary
What is CSP frame-ancestors?
Learn what CSP frame-ancestors does, how it replaces or complements X-Frame-Options, how to allowlist trusted parents, and how to test framing defenses.
Definition
CSP frame-ancestors is a Content-Security-Policy directive that specifies which parent origins may embed a page in a frame, iframe, embed, or object—providing the modern browser control used to prevent unwanted framing and clickjacking.
Why frame-ancestors matters
If an attacker can iframe your authenticated UI under a decoy, users may click actions they never intended. CSP frame-ancestors is the primary modern header directive that stops unwanted parents from embedding your pages.
It is one of the highest-impact CSP directives for account and admin surfaces—even when you are not yet ready for a strict script-src.
How frame-ancestors works
Decide who may embed the page
None, same origin only, or an explicit list of trusted parent origins.
Send CSP with frame-ancestors
Deliver Content-Security-Policy as an HTTP header on HTML responses.
Browser checks ancestor chain
When framing is attempted, the browser validates parent origins against the directive.
Unauthorized embeds fail
The framed document is not shown to the user in that hostile parent.
Common configurations
| Policy | Meaning | Use when |
|---|---|---|
| frame-ancestors 'none' | No framing allowed | Login, settings, admin, checkout confirmation |
| frame-ancestors 'self' | Only same-origin parents | First-party frames only |
| frame-ancestors https://partner.example | Explicit trusted parents | Deliberate embed partnerships |
| Missing directive | Framing allowed by CSP (other headers may still apply) | Avoid for sensitive HTML |
Relationship to X-Frame-Options
Modern control
frame-ancestors supports flexible origin allowlists beyond DENY/SAMEORIGIN.
Legacy coverage
X-Frame-Options still helps older clients that lack full CSP framing support.
Header only
frame-ancestors must be on the HTTP CSP header, not a meta CSP.
Defense in depth
Many teams send both while standardizing on CSP as source of truth.
Rollout checklist
- Inventory pages that must never be framed and set frame-ancestors 'none'.
- Allowlist only explicit partner origins for intentional embeds.
- Send the directive on HTML responses via HTTP headers.
- Cover CDN, reverse-proxy, and alternate hostnames.
- Add X-Frame-Options where legacy compatibility matters.
- Test with an external iframe harness for login and settings URLs.
- Avoid frame-ancestors * on authenticated application UI.
- Re-check after introducing new microfrontends or help-widget embeds.
The practical takeaway
CSP frame-ancestors controls which sites may embed your page and is the modern foundation of clickjacking defense. Prefer 'none' or a tight allowlist over open framing.
Ship it on sensitive HTML responses, keep X-Frame-Options where needed for older browsers, and verify with real external iframe tests—not only header scanners.
Related security terms
Clickjacking
UI redressing attack that frame-ancestors is primarily used to prevent.
X-Frame-Options
Legacy framing header still useful for older clients.
Content Security Policy (CSP)
Parent policy header that contains the frame-ancestors directive.
Iframe Sandbox
Restrictions for embeds you host, complementary to controlling who embeds you.
Frequently asked questions
What does frame-ancestors do?
It tells browsers which sites are allowed to embed your page. If the parent is not allowlisted, the browser refuses to display your page in that frame.
Is frame-ancestors better than X-Frame-Options?
frame-ancestors is the modern, more flexible control and supports an origin allowlist. Keep X-Frame-Options as defense in depth for older user agents when needed.
What does frame-ancestors 'none' mean?
It forbids all framing. Use it for sensitive pages that should never be embedded.
Can I allow only my own site?
Yes. Use frame-ancestors 'self' or list explicit https://parent.example origins.
Does frame-ancestors belong in a meta tag?
No. frame-ancestors is ignored in meta-delivered CSP; send it via HTTP header.
Will frame-ancestors break my payment widget?
If a partner must embed you, add that parent origin explicitly. Do not open framing to * for convenience.
How do I test it?
From an external page, iframe your sensitive URL and confirm the browser blocks framing when headers are present.
References
Explore authoritative guidance and frameworks related to csp frame-ancestors.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.